EC-24102 refresh token to cookie (#22)

* Add refreshAccessToken proxy to the options interface.

* Add storeRefreshToken proxy to the auth options. Update auth context to remove the refresh token from localstorage and to use the proxies for storing the token and refreshing the access token. Update the tests, which were all failing.

* AuthenticationContext constructor no longer makes any HTTP requests — it only wires up dependencies. fetchConfiguration() checks options.fetchServiceConfiguration first; the static AuthorizationServiceConfiguration.fetchFromIssuer is now just the default. ensureInitialized() starts initialization on first public method call and caches the single promise — no more polling with waitFor/sleep. initialize() now fully awaits all code paths (refresh token, auth code callback) — no more fire-and-forget .then() chains.

* Clear the refresh token from the response. Update the tests.

* Fix onSignIn race condition and add a test for it.

* Address issue 3 - Expose idToken returned by custom refreshAccessToken

* Ensure both storeRefreshToken and refreshAccessToken proxies are always used  together. Update tests.

* Fix getIdToken/token response and signOut.

* Update src/authentication/authenticationContext.spec.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/authentication/authenticationContext.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update src/authentication/authenticationContext.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Documentation/comments updated

* Fix the tests that Copilot broke :)

* Make the tokenResponse and tokenPromise nullable.

* Fix stale rejected promises and add a test to  cover this case

* Set _initPromise to null instead of Any

* Implement suggested changes to the tests by copilot

* Persist the refresh token only if one exists. guard-and-reject early when storeRefreshToken is provided but no token was returned. Regex → URLSearchParams: new URLSearchParams(new URL(locationVariable).hash.slice(1)).get('code') and explicit rejection when code is missing.

* location.hash = '' now runs unconditionally as the first action after reading the URL, before any error path can return early.

* callSignInResolvers now uses splice(0) to drain both arrays before invoking — resolvers are cleared, stale rejectors are dropped. New callSignInRejectors mirror helper does the same in reverse. All four inline rejection loops replaced with callSignInRejectors(...) — consistent, no stale references left behind.

* Fix window.location inconsistenmcy

* add window.history mock and use window.history consistently. window.location.hash = '' replaced by this.sanitizeRedirectUrl(). Update tests.

* The valid-token fast path — the most common case on page reload — now returns without any network activity.

* Remove accessTokenResponse.refreshToken from localstorage and add a test for it.

* Use URLSearchParams instead of regex in onAuthorization

* Ensure the configuration is loaded before returning

* Final polishing and an integration test

* Update getAccessToken return type to string or null.

* Improve sanitizeRedirectUrl

* getIdToken() now returns Promise<string | null>, consistent with getAccessToken()

* The IIFE wraps the call in try/finally, which TypeScript transpiles as syntax — no runtime dependency on Promise.prototype.finally. Lib dropped to 2015 from 2018 to avoid confusion.

* Add test isolation cleanup in afterEach (reset window.location, window.history.replaceState, and jest.restoreAllMocks()), a new sanitizeRedirectUrl test for hash-based routes, and update the getAccessToken JSDoc to document the null return case.

* Exception handling added and warnings cleared. Tests added to cover additional scenarios.

* A security and concurrency issues fixed. Tests added to cover the cases.

* Fix onAuthorization error paths to throw (not just call rejectors) so onSignIn() always settles when initialize() encounters a bad redirect; deduplicate concurrent getAccessToken/getIdToken refresh calls by
  routing getIdToken through the shared _refreshTokenPromise gate.

* Always stript the auth data from the redirect url. accessTokenResponse is now only assigned after all persistence succeeds.

* Remove the breaking changes

* getIdToken() failures during sign-out are now logged as warnings and sign-out always completes.

* Replace allSettled with all+catch and move the error handling into the revokeTokens method to satisfy es2015 requirement. Add unit and integration tests.

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: kkignatov

jest.config.js

@@ -2,17 +2,5 @@
 module.exports = {
   preset: "ts-jest",
   testEnvironment: "node",
-  globals: {
-    window: {
-      localStorage: {
-        getItem: () => null,
-      },
-    },
-    localStorage: {
-      getItem: () => null,
-      setItem: () => null,
-      removeItem: () => null,
-    },
-    location: {},
-  },
+  setupFiles: ["./jest.setup.ts"],
 };

jest.setup.ts

@@ -0,0 +1,13 @@
+// In-memory localStorage implementation for the node test environment
+const store: Record<string, string> = {};
+const localStorageMock = {
+    getItem: (key: string) => store[key] ?? null,
+    setItem: (key: string, value: string) => { store[key] = value; },
+    removeItem: (key: string) => { delete store[key]; },
+    clear: () => { Object.keys(store).forEach(k => delete store[k]); },
+};
+(global as any).localStorage = localStorageMock;
+const historyMock = { replaceState: () => {} };
+(global as any).window = { localStorage: localStorageMock, location: {}, history: historyMock };
+(global as any).location = {};
+(global as any).history = historyMock;